The vulnerability in itsourcecode Hospital Management System 1.0 involves SQL injection through the delid parameter in the /viewdepartment.php file. An attacker can remotely manipulate this argument to inject SQL commands, potentially impacting confidentiality, integrity, and availability of the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. No official patch or fix has been documented in the provided data.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The CVSS score of 6.3 reflects a moderate impact on confidentiality, integrity, and availability. However, no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and validate or sanitize input parameters to mitigate SQL injection risks.